I'd like to patch some Windows PE
file to show just simple MessageBox
. Taking into account that the PE
in question doesn't import the MessageBoxA
function if I'm right that all i need to do is to add the user32.dll
to the Imports Section
with MessageBoxA
function. And then just patch the code (using IDA
or OllyDbg
or sth. similar) adding a call
instruction to the address of the newly added MessageBoxA
function from Imports
? If I'm right that after adding a new entry to the Imports
the Windows Loader
automatically map the MessageBoxA
function physical address to the virtual PE address space making the PE possible to call the needed function?
call
won't help you. Depending on what the target is -- OllyDbg makes me assume x86 or x64, though -- you need to be aware of the calling convention(s) and pass the arguments in registers or on the stack accordingly. So it'd be somemov
orpush
before thecall
, too.